VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 27, 2021· Updated Aug 3, 2024

Heap-based Buffer Overflow in vim/vim

CVE-2021-3903

Description

Vim versions prior to 8.2.3564 contain a heap-based buffer overflow in the screen update logic when scrolling in ex mode, potentially leading to memory corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim versions prior to 8.2.3564 contain a heap-based buffer overflow in the screen update logic when scrolling in ex mode, potentially leading to memory corruption.

Vulnerability

CVE-2021-3903 is a heap-based buffer overflow in Vim, affecting versions before the patch 8.2.3564. The vulnerability resides in the screen update logic when scrolling in ex mode, specifically when w_botline is invalid [2]. The bug can be triggered by executing certain commands (e.g., diffsplit followed by norm os0\x030(\x04) in ex mode, as demonstrated in the test case added by the fix [2].

Exploitation

An attacker can exploit this vulnerability by crafting a file or a sequence of Vim commands that cause scrolling in ex mode with an invalid screen state. The attacker does not require authentication but relies on the victim opening the malicious file or executing the crafted commands. The exploit path is reachable when Vim is run with -e (ex mode) and -s (script) options, as shown in the test [2].

Impact

Successful exploitation of the heap-based buffer overflow can lead to memory corruption, potentially resulting in a denial of service (crash) or arbitrary code execution in the context of the Vim process. The impact is limited to the privileges of the user running Vim, but could be elevated if Vim is configured to run with higher privileges (e.g., for editing system files) [1].

Mitigation

The vulnerability is fixed in Vim version 8.2.3564, released on October 4, 2021 [2]. Users should update to this version or later. As a workaround, avoid opening untrusted files in ex mode or running Vim scripts from untrusted sources. No official workaround other than patching has been published.

References
  1. security - Re: 3 new CVE's in vim
  2. patch 8.2.3564: invalid memory access when scrolling without valid sc… · vim/vim@777e7c2

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Invalid `w_botline` value during scrolling in Ex mode leads to heap-based buffer overflow."

Attack vector

An attacker can trigger the heap-based buffer overflow by crafting a file that, when opened in Vim's Ex mode (`-e`), causes the editor to scroll using control characters (e.g., `0x03`, `0x28`, `0x04`) while a `diffsplit` window is active [ref_id=1]. The invalid `w_botline` value leads to out-of-bounds memory access during screen redraw. No authentication is required beyond the victim opening the malicious file with Vim.

Affected code

The vulnerability resides in Vim's screen update logic, specifically in how `w_botline` is handled when scrolling in Ex mode. The patch adds a test (`Test_scroll_in_ex_mode`) that reproduces the invalid memory access by using `diffsplit` and control characters (`0x03`, `0x28`, `0x04`) in Ex mode, which caused `w_botline` to become invalid and led to a heap-based buffer overflow [ref_id=1].

What the fix does

The commit [ref_id=1] adds a regression test (`Test_scroll_in_ex_mode`) that reproduces the crash scenario using `diffsplit` and control characters in Ex mode. While the diff shown is primarily whitespace/style changes and the new test, the test itself validates that the invalid memory access no longer occurs. The underlying fix (not fully visible in this diff excerpt) ensures `w_botline` is properly validated before being used in scroll operations, preventing the heap-based buffer overflow.

Preconditions

  • inputThe victim must open a crafted file in Vim's Ex mode (`-e`) or via a script that triggers the scrolling sequence.
  • inputThe file must contain control characters (0x03, 0x28, 0x04) and a `diffsplit` command to trigger the invalid `w_botline` state.

Generated on May 29, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.